@youdie006/prodex 0.19.0 → 0.19.2

package/dist/chatgpt-browser.js

@@ -1729,7 +1729,7 @@ export async function sendChatGptPrompt(options) {
         // into; a --project/--project-new hop lands on a page with its own counts.
         beforeSubmit = await evaluateOnPage(page, answerExpression());
         dbgSend(`baseline url=${beforeSubmit.url} user=${beforeSubmit.userMessageCount} assistant=${beforeSubmit.assistantMessageCount}`);
-        await insertComposerTextViaCdp(cdp, options.prompt);
+        await insertComposerTextViaCdp(cdp, options.prompt, page);
         // The send button renders asynchronously after the prompt lands. Poll for it
         // BEFORE submitting so (a) submitButtonFound reflects whether the control
         // actually EXISTS - otherwise a successful Enter-key submit skips the fallback
@@ -2263,6 +2263,36 @@ export function prepareComposerExpression() {
 // just that it is non-empty): a failed clear would leave stale text prepended,
 // silently submitting a contaminated prompt. Whitespace is collapsed on both
 // sides because ProseMirror round-trips newlines as extra blank lines.
+/**
+ * Insert the whole prompt with ONE in-page execCommand("insertText"). The
+ * editor applies it as a single input event, so - unlike a chunked
+ * Input.insertText sequence - nothing can interleave at a boundary and the
+ * text lands byte-for-byte. Used for prompts too large to push through
+ * Input.insertText in one CDP command.
+ */
+export function insertComposerTextInPageExpression(text) {
+    const textJson = JSON.stringify(text);
+    return `(() => {
+    ${composerExpressionHelpers()}
+    const el = findChatGptComposerCandidate();
+    if (!el) return { ok: false, reason: "No visible composer" };
+    el.focus();
+    if ("value" in el) {
+      el.value = ${textJson};
+      el.dispatchEvent(new Event("input", { bubbles: true }));
+      return { ok: true };
+    }
+    const selection = window.getSelection();
+    const all = document.createRange();
+    all.selectNodeContents(el);
+    selection.removeAllRanges();
+    selection.addRange(all);
+    document.execCommand("delete");
+    const inserted = document.execCommand("insertText", false, ${textJson});
+    if (!inserted) return { ok: false, reason: "The ChatGPT composer refused the prompt text" };
+    return { ok: true };
+  })()`;
+}
 export function composerTextStateExpression(expectedText) {
     const expectedJson = JSON.stringify(expectedText ?? null);
     return `(() => {
@@ -2283,7 +2313,7 @@ export function composerTextStateExpression(expectedText) {
 // Focus the composer, clear any leftover text submit-safely, type the prompt
 // with native CDP input so ProseMirror registers it, then verify the composer
 // holds exactly the prompt.
-async function insertComposerTextViaCdp(cdp, text) {
+async function insertComposerTextViaCdp(cdp, text, page) {
     const prepared = await cdp.evaluate(prepareComposerExpression());
     if (!prepared.ok)
         throw new Error(prepared.reason ?? "Could not focus the ChatGPT composer");
@@ -2299,13 +2329,42 @@ async function insertComposerTextViaCdp(cdp, text) {
         await cdp.send("Input.dispatchKeyEvent", { type: "keyUp", key: "Backspace", code: "Backspace", windowsVirtualKeyCode: 8 });
         await sleep(100);
     }
-    // Insert in bounded chunks: a single multi-KB Input.insertText makes
-    // ProseMirror do one huge transaction, which on a heavy thread stalls past
-    // the 20s CDP command timeout and kills the send with "Chrome DevTools
-    // command timed out: Input.insertText" (field failure on long prompts,
-    // twice in one session). Each chunk gets its own command budget.
-    for (const chunk of chunkComposerText(text)) {
-        await cdp.send("Input.insertText", { text: chunk });
+    // Insertion path, chosen by size:
+    //
+    // Short prompts go through Input.insertText - real key-level input events,
+    // which is what ChatGPT's composer is built for.
+    //
+    // Long prompts do NOT. One giant insertText stalls ProseMirror past the CDP
+    // command timeout, and splitting it into chunks corrupts the text at the
+    // chunk boundaries: measured live on a 95 KB prompt, the composer ended up
+    // the right LENGTH but with content shifted from the first boundary on
+    // (first divergence at 3,938 chars with a 4,000-char chunk size), which is
+    // what surfaced to users as "Composer text did not match after insertion".
+    // Both failures come from crossing the CDP boundary mid-edit, so large text
+    // is inserted by a single in-page execCommand instead: the editor applies it
+    // as one input event and nothing can interleave. Measured: 67 KB inserted in
+    // ~20s, verified byte-for-byte.
+    if (text.length <= COMPOSER_INSERT_CHUNK_CHARS) {
+        await cdp.send("Input.insertText", { text });
+    }
+    else {
+        // A 67 KB insert measured ~20s in the page, which the default 20s CDP
+        // command budget would cut off, so this one call gets its own connection
+        // with a size-scaled budget instead of loosening the budget for every
+        // command on the shared connection.
+        const budgetMs = Math.max(60_000, Math.ceil(text.length / 1_000) * 1_000);
+        const slowCdp = page ? await connectCdp(page.webSocketDebuggerUrl, budgetMs) : undefined;
+        try {
+            const target = slowCdp ?? cdp;
+            if (slowCdp)
+                await slowCdp.send("Runtime.enable");
+            const inserted = await target.evaluate(insertComposerTextInPageExpression(text));
+            if (!inserted?.ok)
+                throw new Error(inserted?.reason ?? "Could not insert the prompt into the ChatGPT composer");
+        }
+        finally {
+            slowCdp?.close();
+        }
     }
     await sleep(200);
     const state = await cdp.evaluate(composerTextStateExpression(text));

package/dist/cli-server.js

@@ -4,7 +4,7 @@ import { parseProMode, parseReasoningEffort } from "./chatgpt-browser.js";
 import { ASK_PRO_SELECTION_CLEAR_FLAGS, ASK_PRO_SELECTION_DEFAULT_FLAGS, assertNoExtraArgs, assertOnlyOptions, isHelpSubcommand, printHelpIfRequested, readFlag, readPortFlag, readPositiveNumberFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError } from "./cli-args.js";
 import { printInitHelp, printSetupHelp, printStartHelp, printStatusHelp, printTunnelHelp, printTunnelUrlHelp } from "./cli-help.js";
 import { errorMessage, isLoopbackHost, isMissingFileError, sourceAwareSetupMessage } from "./cli-shared.js";
-import { getTokenExpiryStatus, loadLocalConfig, writeLocalConfig } from "./config.js";
+import { getTokenExpiryStatus, loadLocalConfig, writeLocalConfig, composeServerUrlWithToken } from "./config.js";
 import { startHttpMcpServer } from "./http-mcp.js";
 import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
 import { BridgeStore } from "./store.js";
@@ -49,7 +49,7 @@ export async function runSetupCommand(rest, io) {
     io.stdout("Saved local ChatGPT Developer Mode MCP profile.");
     io.stdout(`Server URL: ${redactServerUrl(config.server_url)}`);
     io.stdout(formatTokenExpiryLine(config));
-    io.stdout("Full URL is stored in .bridge/config.local.json.");
+    io.stdout("The token is stored (once) in .bridge/config.local.json; print the full URL with `prodex status --show-token --url-only`.");
     if (config.browser_defaults) {
         io.stdout(`Browser send defaults: ${formatBrowserDefaults(config.browser_defaults)}`);
     }
@@ -102,7 +102,10 @@ export async function runStatusCommand(rest, io) {
     const nonExpiringRevealWarning = showToken && allowNonExpiringTokenReveal && tokenStatus.status === "non_expiring"
         ? sourceAwareSetupMessage("Showing a non-expiring token. Keep this local-only and rotate it with `prodex setup --token-ttl-hours <hours>` before any tunnel or ChatGPT Project use.", sourceCli, { cwd: setupHintCwd })
         : undefined;
-    const serverUrl = formatServerUrlForOutput(config.server_url, { showToken });
+    // The token is no longer persisted inside server_url, so compose the
+    // usable URL here; masking still applies when the caller did not ask for
+    // the token.
+    const serverUrl = formatServerUrlForOutput(composeServerUrlWithToken(config), { showToken });
     if (rest.includes("--url-only")) {
         if (showToken)
             io.stderr(TOKEN_BEARING_MCP_URL_AUTHORITY_WARNING);

package/dist/cli.js

@@ -10,7 +10,7 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { renderBanner, shouldColorize } from "./banner.js";
 import { getChatGptBrowserStatus, resolveCdpPort } from "./chatgpt-browser.js";
-import { getTokenExpiryStatus, loadLocalConfig } from "./config.js";
+import { getTokenExpiryStatus, loadLocalConfig, resolveProdexCwd } from "./config.js";
 import { startHttpMcpServer } from "./http-mcp.js";
 import { createMcpToolHandlers } from "./mcp-tools.js";
 import { runMcpServer } from "./mcp.js";
@@ -216,7 +216,10 @@ export async function runCli(args, io = defaultIo()) {
 }
 function defaultIo() {
     return {
-        cwd: process.cwd(),
+        // PRODEX_CWD wins over a working directory prodex cannot use (a /dev/fd
+        // pipe path from an agent harness, a deleted directory); --cwd still wins
+        // over both where a command accepts it.
+        cwd: resolveProdexCwd(),
         stdout: (line) => console.log(line),
         stderr: (line) => console.error(line),
         isInteractive: process.stdout.isTTY === true,

package/dist/config.js

@@ -59,6 +59,33 @@ export function localConfigPath(cwd) {
 export function makeServerUrl(host, port, token) {
     return `http://${host}:${port}/mcp?prodex_token=${encodeURIComponent(token)}`;
 }
+/**
+ * The endpoint WITHOUT the token, which is what gets persisted. The token used
+ * to be stored twice - as `token` and inside `server_url` - so an operator's
+ * redaction that masked the key still leaked the secret from the URL (field
+ * report). One field is the only shape where masking the token masks it.
+ */
+export function makeServerUrlBase(host, port) {
+    return `http://${host}:${port}/mcp`;
+}
+/** The token-bearing URL, composed on demand for clients that need it. */
+export function composeServerUrlWithToken(config) {
+    const url = new URL(config.server_url);
+    url.searchParams.set("prodex_token", config.token);
+    return url.toString();
+}
+/** Strip a token that an older config (or a hand edit) left in the URL. */
+export function stripTokenFromServerUrl(serverUrl) {
+    try {
+        const url = new URL(serverUrl);
+        url.searchParams.delete("prodex_token");
+        url.search = url.searchParams.toString();
+        return url.toString();
+    }
+    catch {
+        return serverUrl;
+    }
+}
 export function normalizeLoopbackHttpHost(host) {
     const normalized = host.trim().toLowerCase();
     const isLocalhost = normalized === "localhost";
@@ -90,7 +117,7 @@ export async function writeLocalConfig(cwd, input = {}) {
         host,
         port,
         token,
-        server_url: makeServerUrl(host, port, token),
+        server_url: makeServerUrlBase(host, port),
         ...(tokenExpiresAt ? { token_expires_at: tokenExpiresAt } : {}),
         ...(browserDefaults ? { browser_defaults: browserDefaults } : {}),
         created_at: existing?.created_at ?? now,
@@ -126,7 +153,26 @@ export async function loadLocalConfig(cwd) {
     }
     assertLoopbackHttpHost(config.host);
     assertLoopbackHttpHost(new URL(config.server_url).hostname);
+    // Configs written before the split still carry the token in the URL. Drop it
+    // in memory AND rewrite the file: leaving it on disk is the whole problem
+    // being fixed - an operator reading config.local.json would still find the
+    // secret twice, and any redaction keyed to `token` would miss one copy.
+    const strippedServerUrl = stripTokenFromServerUrl(config.server_url);
+    const carriedDuplicate = strippedServerUrl !== config.server_url;
+    config = { ...config, server_url: strippedServerUrl };
     assertServerUrlMatchesConfig(config);
+    if (carriedDuplicate) {
+        // Best effort: a read-only checkout or a concurrent writer must not turn
+        // a working config into a failed command.
+        try {
+            await writeVerifiedUtf8File(localConfigPath(cwd), `${JSON.stringify(config, null, 2)}\n`, () => assertLocalConfigTargetSafe(cwd), {
+                mode: 0o600
+            });
+        }
+        catch {
+            // The in-memory strip above already keeps prodex from printing it.
+        }
+    }
     return config;
 }
 // Global browser-selection defaults from the environment, used when a repo has
@@ -217,13 +263,13 @@ function isTokenExpired(tokenExpiresAt, now) {
 }
 function assertServerUrlMatchesConfig(config) {
     const serverUrl = new URL(config.server_url);
-    const tokenParams = serverUrl.searchParams.getAll("prodex_token");
     const hostMatches = normalizeLoopbackHttpHost(serverUrl.hostname) === normalizeLoopbackHttpHost(config.host);
     const portMatches = effectiveUrlPort(serverUrl) === config.port;
-    const tokenMatches = tokenParams.length === 1 && tokenParams[0] === config.token;
-    const shapeMatches = serverUrl.protocol === "http:" && serverUrl.pathname === "/mcp" && Array.from(serverUrl.searchParams.keys()).length === 1;
-    if (!hostMatches || !portMatches || !tokenMatches || !shapeMatches) {
-        throw new Error(".bridge/config.local.json server_url must match host, port, and token. Run `prodex setup` to replace it.");
+    // The persisted URL must carry NO query at all: the token lives in `token`
+    // and nowhere else.
+    const shapeMatches = serverUrl.protocol === "http:" && serverUrl.pathname === "/mcp" && Array.from(serverUrl.searchParams.keys()).length === 0;
+    if (!hostMatches || !portMatches || !shapeMatches) {
+        throw new Error(".bridge/config.local.json server_url must be the token-free endpoint for host and port. Run `prodex setup` to replace it.");
     }
 }
 function effectiveUrlPort(url) {
@@ -359,3 +405,16 @@ async function assertDirectoryHandle(handle, label) {
         throw new Error(`${label} must be a real directory`);
     }
 }
+/**
+ * The repo prodex should operate on. Defaults to the process working
+ * directory, but PRODEX_CWD (absolute paths only) wins: the MCP server takes
+ * no flags, so when an agent harness starts it from a pipe path or a deleted
+ * directory, the env var is the only way an operator can pin the repo without
+ * changing how that harness spawns the server.
+ */
+export function resolveProdexCwd(fallback = process.cwd(), env = process.env) {
+    const raw = (env.PRODEX_CWD ?? "").trim();
+    if (raw.length === 0 || !path.isAbsolute(raw))
+        return fallback;
+    return raw;
+}

package/dist/store.js

@@ -35,6 +35,26 @@ async function claimLockIsStale(lockPath) {
 const FETCHABLE_RESULT_ARTIFACT_PREFIXES = [".bridge/artifacts/pro-consults/", ".bridge/artifacts/results/"];
 export const MAX_FETCHABLE_RESULT_ARTIFACT_BYTES = 100_000;
 const MAX_BRIDGE_ARTIFACT_READ_BYTES = 1_000_000;
+// A bridge root has to be a real directory in a real filesystem. Field report
+// (macOS): an agent harness started `prodex mcp` with a working directory of
+// /dev/fd/<n> - a file-descriptor path - so every call failed with a raw
+// ENOENT/ENOTDIR on <root>/tasks, /sessions, /receipts, with a different
+// number each time, and the operator had no way to tell what prodex had
+// resolved or how to override it.
+const NON_REPO_ROOT_PREFIXES = ["/dev/", "/proc/", "/sys/"];
+export async function assertUsableBridgeRoot(root) {
+    const looksLikeDevicePath = NON_REPO_ROOT_PREFIXES.some((prefix) => root.startsWith(prefix));
+    let isDirectory = false;
+    try {
+        isDirectory = (await stat(root)).isDirectory();
+    }
+    catch {
+        isDirectory = false;
+    }
+    if (isDirectory && !looksLikeDevicePath)
+        return;
+    throw new Error(`Bridge root is not a usable repo directory: ${root}${looksLikeDevicePath ? " (that is a file-descriptor/device path, not a repo)" : ""}. prodex uses the process working directory when no --cwd is given, so a server started from a pipe or a deleted directory lands here. Pass --cwd /absolute/path/to/repo, or set PRODEX_CWD=/absolute/path/to/repo (works for the MCP server, which takes no flags).`);
+}
 export class BridgeStore {
     root;
     bridgeDir;
@@ -43,6 +63,7 @@ export class BridgeStore {
         this.bridgeDir = path.join(root, ".bridge");
     }
     async ensure() {
+        await assertUsableBridgeRoot(this.root);
         await ensurePrivateDirectory(this.bridgeDir, "Bridge directory");
         await Promise.all([
             ensurePrivateDirectory(this.dir("tasks"), "Bridge storage directory .bridge/tasks"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",